WordPress.org
Get WordPress

Plugin Directory

Changeset 2784230


Ignore:
Timestamp:
09/13/2022 09:47:27 PM (2 years ago)
Author:
resmushit
Message:

0.4.6 : fix in WP's Way + curl check

Location:
resmushit-image-optimizer/trunk
Files:
6 edited

Legend:

Unmodified
Added
Removed

  • resmushit-image-optimizer/trunk/classes/resmushit.class.php

    r2768724 r2784230  
    6060            return false;
    6161        }
    62 
     62        if(! in_array('curl', get_loaded_extensions())){
     63            return false;
     64        }
     65       
    6366        $ch = curl_init();
    6467        curl_setopt($ch, CURLOPT_URL, RESMUSHIT_ENDPOINT);

  • resmushit-image-optimizer/trunk/classes/resmushitUI.class.php

    r2784196 r2784230  
    2222    public static function fullWidthPanel($title = null, $html = null, $border = null) {
    2323        self::fullWidthPanelWrapper($title, $html, $border);
    24         echo $html;
     24        echo wp_kses_post($html);
    2525        self::fullWidthPanelEndWrapper();
    2626    }
    … …  
    4444            $borderClass = 'brdr-'.$border;
    4545        }
    46         echo "<div class='rsmt-panel w100 $borderClass'><h2>$title</h2>";
     46        echo wp_kses_post("<div class='rsmt-panel w100 $borderClass'><h2>$title</h2>");
    4747    }
    4848
    … …  
    5858     */
    5959    public static function fullWidthPanelEndWrapper() {
    60         echo "</div>";
     60        echo wp_kses_post("</div>");
    6161    }
    6262
    … …  
    8888     */
    8989    public static function settingsPanel() {
     90        $allowed_html = array(
     91            'input' => array(
     92                'type'      => array(),
     93                'name'      => array(),
     94                'value'     => array(),
     95                'checked'   => array(),
     96                'class'   => array(),
     97                'id'   => array()
     98            ),
     99            'form' => array(
     100                'method'      => array(),
     101                'action'      => array(),
     102                'id'     => array()
     103            ),
     104            'div' => array(
     105              'class'      => array(),
     106            ),
     107            'span' => array(
     108              'class'      => array(),
     109            ),
     110            'table' => array(
     111              'class'      => array(),
     112            ),
     113            'label' => array(
     114              'class'      => array(),
     115            ),
     116            'p' => array()
     117        );
     118
    90119        self::fullWidthPanelWrapper(__('Settings', 'resmushit-image-optimizer'), null, 'orange');
    91120        $new_label = "<span class='new'>" . __("New!", 'resmushit-image-optimizer') . "</span>";
    92         echo '<div class="rsmt-settings">
    93             <form method="post" action="options.php" id="rsmt-options-form">';
     121        echo wp_kses('<div class="rsmt-settings">
     122            <form method="post" action="options.php" id="rsmt-options-form">', $allowed_html);
    94123        settings_fields( 'resmushit-settings' );
    95124        do_settings_sections( 'resmushit-settings' );
    96125       
    97         echo '<table class="form-table">'
     126
     127       
     128        echo wp_kses('<table class="form-table">'
    98129                . self::addSetting("text", __("Image quality", 'resmushit-image-optimizer'), __("Default value is 92. The quality factor must be between 0 (very weak) and 100 (best quality)", 'resmushit-image-optimizer'), "resmushit_qlty")
    99130                . self::addSetting("checkbox", __("Optimize on upload", 'resmushit-image-optimizer'), __("All future images uploaded will be automatically optimized", 'resmushit-image-optimizer'), "resmushit_on_upload")
    … …  
    103134                . self::addSetting("checkbox", $new_label . __("Preserve EXIF", 'resmushit-image-optimizer'), __("Will preserve EXIF data during optimization", 'resmushit-image-optimizer'), "resmushit_preserve_exif")
    104135                . self::addSetting("checkbox", $new_label . __("Do not preserve backups", 'resmushit-image-optimizer'), sprintf(__("Will not preserve a backup of the original file (save space). <a href='%s' title='Should I remove backups?' target='_blank'>Read instructions</a> carefully before enabling.", 'resmushit-image-optimizer'), 'https://resmush.it/wordpress/why-keeping-backup-files'), "resmushit_remove_unsmushed")
    105                 . '</table>';
     136                . '</table>', $allowed_html);
    106137        submit_button();
    107         echo '</form></div>';
     138        echo wp_kses('</form></div>', $allowed_html);
    108139        self::fullWidthPanelEndWrapper();       
    109140    }
    … …  
    132163        }
    133164
    134         echo "<div class='rsmt-bulk'><div class='non-optimized-wrapper $additionnalClassNeedOptimization'><h3 class='icon_message warning'>";
     165        echo wp_kses_post("<div class='rsmt-bulk'><div class='non-optimized-wrapper $additionnalClassNeedOptimization'><h3 class='icon_message warning'>");
    135166
    136167        if(get_option('resmushit_cron') && get_option('resmushit_cron') == 1) {
    137             echo  "<em>$countNonOptimizedPictures "
     168            echo  wp_kses_post("<em>$countNonOptimizedPictures "
    138169            . __('non optimized pictures will be automatically optimized', 'resmushit-image-optimizer')
    139170            . "</em>.</h3><p>"
    140171            . __('These pictures will be automatically optimized using schedule tasks (cronjobs).', 'resmushit-image-optimizer')
    141172            . " "
    142             . __('Image optimization process can be launched <b>manually</b> by clicking on the button below :', 'resmushit-image-optimizer');
     173            . __('Image optimization process can be launched <b>manually</b> by clicking on the button below :', 'resmushit-image-optimizer'));
    143174        } else {
    144             echo  __('There is currently', 'resmushit-image-optimizer')
     175            echo  wp_kses_post(__('There is currently', 'resmushit-image-optimizer')
    145176            . " <em>$countNonOptimizedPictures "
    146177            . __('non optimized pictures', 'resmushit-image-optimizer')
    147178            . "</em>.</h3><p>"
    148             . __('This action will resmush all pictures which have not been optimized to the good Image Quality Rate.', 'resmushit-image-optimizer');
    149         }
    150 
    151         echo "</p><p class='submit' id='bulk-resize-examine-button'><button class='button-primary' onclick='resmushit_bulk_resize(\"bulk_resize_image_list\");'>";
     179            . __('This action will resmush all pictures which have not been optimized to the good Image Quality Rate.', 'resmushit-image-optimizer'));
     180        }
     181
     182        $allowed_html = array_merge(wp_kses_allowed_html( 'post' ), array(
     183            'button' => array(
     184                'class'      => array(),
     185                'onclick'      => array()
     186            )));
     187
     188        echo wp_kses("</p><p class='submit' id='bulk-resize-examine-button'><button class='button-primary' onclick='resmushit_bulk_resize(\"bulk_resize_image_list\");'>", $allowed_html);
    152189       
    153190        if(get_option('resmushit_cron') && get_option('resmushit_cron') == 1) {
    154             echo __('Optimize all pictures manually', 'resmushit-image-optimizer');
     191            echo wp_kses_post(__('Optimize all pictures manually', 'resmushit-image-optimizer'));
    155192        } else {
    156             echo __('Optimize all pictures', 'resmushit-image-optimizer');
    157         }
    158 
    159         echo "</button></p><div id='bulk_resize_image_list'></div></div>"
     193            echo wp_kses_post(__('Optimize all pictures', 'resmushit-image-optimizer'));
     194        }
     195
     196        echo wp_kses_post("</button></p><div id='bulk_resize_image_list'></div></div>"
    160197        . "<div class='optimized-wrapper $additionnalClassNoNeedOptimization'><h3 class='icon_message ok'>"
    161198        . __('Congrats ! All your pictures are correctly optimized', 'resmushit-image-optimizer')
    162         . "</h3></div></div>";
     199        . "</h3></div></div>");
    163200        self::fullWidthPanelEndWrapper();       
    164201    }
    … …  
    186223        }
    187224
    188         echo "<div class='rsmt-bigfiles'><div class='optimized-wrapper $additionnalClass'>
    189                     <h3 class='icon_message info'>";
     225        echo wp_kses_post("<div class='rsmt-bigfiles'><div class='optimized-wrapper $additionnalClass'>
     226                    <h3 class='icon_message info'>");
    190227
    191228        if($countfilesTooBigPictures > 1) {
    192             echo htmlspecialchars($countfilesTooBigPictures, ENT_QUOTES, 'UTF-8') . ' ' . __('pictures are too big (> 5MB) for the optimizer', 'resmushit-image-optimizer');
     229            echo esc_html($countfilesTooBigPictures . ' ' . __('pictures are too big (> 5MB) for the optimizer', 'resmushit-image-optimizer'));
    193230        } else {
    194             echo htmlspecialchars($countfilesTooBigPictures, ENT_QUOTES, 'UTF-8') . ' ' . __('picture is too big (> 5MB) for the optimizer', 'resmushit-image-optimizer');
    195         }
    196         echo "</h3><div class='list-accordion'><h4>"
     231            echo esc_html($countfilesTooBigPictures . ' ' . __('picture is too big (> 5MB) for the optimizer', 'resmushit-image-optimizer'));
     232        }
     233        echo wp_kses_post("</h3><div class='list-accordion'><h4>"
    197234                . __('List of files above 5MB', 'resmushit-image-optimizer')
    198                 . "</h4><ul>";
     235                . "</h4><ul>");
    199236
    200237        foreach($getNonOptimizedPictures->filestoobig as $file){
    … …  
    202239            $filesize = reSmushitUI::sizeFormat(filesize(get_attached_file( $file->ID )));
    203240
    204             echo "<li><a href='"
    205                     . htmlspecialchars(wp_get_attachment_url( $file->ID ), ENT_QUOTES, 'UTF-8')
     241            echo wp_kses_post("<li><a href='"
     242                    . esc_url(wp_get_attachment_url( $file->ID ))
    206243                    . "' target='_blank'>"
    207244                    . wp_get_attachment_image($file->ID, 'thumbnail')
    208245                    . "<span>"
    209                     . htmlspecialchars($fileInfo['basename'], ENT_QUOTES, 'UTF-8') . ' (' . $filesize . ').</span></a></li>';
    210         }
    211         echo '</ul></div></div></div>';
     246                    . $fileInfo['basename'] . ' (' . $filesize . ').</span></a></li>');
     247        }
     248        echo wp_kses_post('</ul></div></div></div>');
    212249       
    213250        self::fullWidthPanelEndWrapper();       
    … …  
    230267        $resmushit_stat = reSmushit::getStatistics();
    231268
    232         echo "<div class='rsmt-statistics'>";
     269        echo wp_kses_post("<div class='rsmt-statistics'>");
    233270
    234271        if($resmushit_stat['files_optimized'] != 0) {
    235             echo "<p><strong>"
     272            echo wp_kses_post("<p><strong>"
    236273                    . __('Space saved :', 'resmushit-image-optimizer')
    237274                    . "</strong> <span id='rsmt-statistics-space-saved'>"
    … …  
    257294                    . "</strong> <span id='rsmt-statistics-total-optimizations'>"
    258295                    . $resmushit_stat['total_optimizations']
    259                     . "</span></p>";
     296                    . "</span></p>");
    260297            } else {
    261                 echo "<p>" . __('No picture has been optimized yet ! Add pictures to your Wordpress Media Library.', 'resmushit-image-optimizer') . "</p>";
     298                echo wp_kses_post("<p>" . __('No picture has been optimized yet ! Add pictures to your Wordpress Media Library.', 'resmushit-image-optimizer') . "</p>");
    262299            }
    263         echo "</div>";
     300        echo wp_kses_post("</div>");
    264301        self::fullWidthPanelEndWrapper();       
    265302    }
    … …  
    278315        }
    279316        self::fullWidthPanelWrapper(__('Restore Media Library', 'resmushit-image-optimizer'), null, 'black');
    280 
    281         echo "<div class='rsmt-restore'>";
    282 
    283         echo
    284             '<p><strong>'
     317        $allowed_html = array_merge(wp_kses_allowed_html( 'post' ), array(
     318        'input' => array(
     319            'type'      => array(),
     320            'value'      => array(),
     321            'class'      => array(),
     322            'name'      => array()
     323        )));
     324
     325        echo wp_kses("<div class='rsmt-restore'>"
     326            . '<p><strong>'
    285327            . __('Warning! By clicking the button below, you will restore all the original pictures, as before reSmush.it Image Optimizer installation. You will not have your pictures optimized! We strongly advice to be sure to have a complete backup of your website before performing this action', 'resmushit-image-optimizer')
    286328            . '</strong></p><p>'
    287             . '<input type="button" value="'. __('Restore ALL my original pictures', 'resmushit-image-optimizer') .'" class="rsmt-trigger--restore-backup-files button media-button  select-mode-toggle-button" name="resmushit" class="button wp-smush-send" />';
    288         echo "</div>";
     329            . '<input type="button" value="'. __('Restore ALL my original pictures', 'resmushit-image-optimizer') .'" class="rsmt-trigger--restore-backup-files button media-button  select-mode-toggle-button" name="resmushit" class="button wp-smush-send" />'
     330            . '</div>', $allowed_html);
    289331        self::fullWidthPanelEndWrapper();       
    290332    }
    … …  
    300342        global $wp_version;
    301343       
    302         echo "<div class='rsmt-news'>";
     344        echo wp_kses_post("<div class='rsmt-news'>");
    303345       
    304346        self::fullWidthPanelWrapper(__('News', 'resmushit-image-optimizer'), null, 'red');
    305         $ch = curl_init();
    306         curl_setopt($ch, CURLOPT_URL, RESMUSHIT_NEWSFEED);
    307         curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    308         curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 3);
    309         curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
    310         curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
    311         $data_raw = curl_exec($ch);
    312         curl_close($ch);
    313         $data = json_decode($data_raw);
    314        
     347        if(in_array('curl', get_loaded_extensions())){
     348            $ch = curl_init();
     349            curl_setopt($ch, CURLOPT_URL, RESMUSHIT_NEWSFEED);
     350            curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
     351            curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 3);
     352            curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
     353            curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
     354            $data_raw = curl_exec($ch);
     355            curl_close($ch);
     356            $data = json_decode($data_raw);
     357        } else {
     358            $data = [];
     359        }
    315360        if($data) {
    316361            foreach($data as $i=>$news) {
    … …  
    319364                }
    320365
    321                 echo "<div class='news-item'><span class='news-date'>"
     366                echo wp_kses_post("<div class='news-item'><span class='news-date'>"
    322367                        . date('d/m/Y', $news->date)
    323                         . "</span>";
     368                        . "</span>");
    324369                if($news->picture) {
    325                     echo "<div class='news-img'><a href='"
    326                             . htmlspecialchars($news->link, ENT_QUOTES, 'UTF-8')
     370                    echo wp_kses_post("<div class='news-img'><a href='"
     371                            . esc_url($news->link)
    327372                            . "' target='_blank'><img src='"
    328                             . htmlspecialchars($news->picture, ENT_QUOTES, 'UTF-8')
    329                             . "' /></a></div>";
     373                            . esc_url($news->picture)
     374                            . "' /></a></div>");
    330375                }
    331                 echo "<h3><a href='"
    332                         . htmlspecialchars($news->link, ENT_QUOTES, 'UTF-8')
     376                echo wp_kses_post("<h3><a href='"
     377                        . esc_url($news->link)
    333378                        . "' target='_blank'>"
    334                         . htmlspecialchars($news->title, ENT_QUOTES, 'UTF-8')
     379                        . $news->title
    335380                        . "</a></h3><div class='news-content'>"
    336                         . htmlspecialchars($news->content, ENT_QUOTES, 'UTF-8')
    337                         . "</div>";
     381                        . $news->content
     382                        . "</div>");
    338383            }
    339384        }
    340385
    341         echo "<div class='social'>"
     386        echo wp_kses_post("<div class='social'>"
    342387                . "<p class='datainformation'>"
    343388                . __('No user data nor any information is collected while requesting this news feed.', 'resmushit-image-optimizer')
    … …  
    352397                . "' href='https://www.twitter.com/resmushit' target='_blank'>"
    353398                . "<img src='"
    354                 . RESMUSHIT_BASE_URL . "images/twitter.png' /></a></div></div>";
     399                . RESMUSHIT_BASE_URL . "images/twitter.png' /></a></div></div>");
    355400       
    356401        self::fullWidthPanelEndWrapper();       
    … …  
    377422        if(resmushit_get_cron_status() != 'DISABLED' && resmushit_get_cron_status() != 'OK') {
    378423           
    379             echo "<div class='rsmt-alert'>";
    380             echo "<h3 class='icon_message warning'>"
     424            echo wp_kses_post("<div class='rsmt-alert'>"
     425            . "<h3 class='icon_message warning'>"
    381426            . __('Cronjobs seems incorrectly configured', 'resmushit-image-optimizer')
    382             . "</h3>";
     427            . "</h3>");
    383428
    384429            if (resmushit_get_cron_status() == 'MISCONFIGURED') {
    385                 echo "<p>"
     430                echo wp_kses_post("<p>"
    386431                    . __('Cronjobs are not correctly configured. The variable <em>DISABLE_WP_CRON</em> must be set to <em>TRUE</em> in <em>wp-config.php</em>. Please install them by reading the following <a href="https://resmush.it/wordpress/howto-configure-cronjobs" target="_blank">instruction page</a>.', 'resmushit-image-optimizer')
    387432                    . "</p><p>"
    388433                    . __('We advice to disable Remush.it option "Process optimize on CRON" as long as Cron jobs are incorrectly set up.', 'resmushit-image-optimizer')
    389                     . "</p>";
     434                    . "</p>");
    390435            } else if (resmushit_get_cron_status() == 'NEVER_RUN') {
    391                 echo "<p>"
     436                echo wp_kses_post("<p>"
    392437                    . __('Cronjobs seems to have never been launched. Please install them by reading the following <a href="https://resmush.it/wordpress/howto-configure-cronjobs" target="_blank">instruction page</a>.', 'resmushit-image-optimizer')
    393                     . "</p>";
     438                    . "</p>");
    394439            } else if (resmushit_get_cron_status() == 'NO_LATELY_RUN') {
    395                 echo "<p>"
     440                echo wp_kses_post("<p>"
    396441                    . __('Cronjobs seems not to have run lately. Please read the following <a href="https://resmush.it/wordpress/howto-configure-cronjobs" target="_blank">instruction page</a> to install them correctly.', 'resmushit-image-optimizer')
    397442                    . "<ul><li><em>" . __('Expected Frequency :', 'resmushit-image-optimizer') . "</em> " . __('Every', 'resmushit-image-optimizer') . " " . time_elapsed_string(RESMUSHIT_CRON_FREQUENCY) . "</li>"
    398443                    . "<li><em>" . __('Last run :', 'resmushit-image-optimizer') . "</em> " . time_elapsed_string(time() - get_option('resmushit_cron_lastrun')) . " " . __('ago', 'resmushit-image-optimizer') . "</li></ul>"
    399                     . "</p>";
     444                    . "</p>");
    400445            }
    401             echo "</div>";
     446            echo wp_kses_post("</div>");
    402447        }
    403448        if(get_option('resmushit_remove_unsmushed') == 1 && get_option('resmushit_has_no_backup_files') == 0) {
    … …  
    405450
    406451            if($files_to_delete) {
    407                 echo "<div class='rsmt-alert'>";
    408                 echo "<h3 class='icon_message warning'>"
     452                $allowed_html = array_merge(wp_kses_allowed_html( 'post' ), array(
     453                'input' => array(
     454                    'type'      => array(),
     455                    'value'      => array(),
     456                    'class'      => array(),
     457                    'name'      => array(),
     458                )));
     459                echo wp_kses("<div class='rsmt-alert'>"
     460                . "<h3 class='icon_message warning'>"
    409461                . __('Backup files can be removed.', 'resmushit-image-optimizer')
    410                 . "</h3>";
    411 
    412                 echo
    413                     '<p>'
    414                     . sprintf(__('Keep these files and turn off "Do not preserve backups" option if you want to restore your unoptimized files in the future. Please <a href="%s" title="Should I remove backups? target="_blank">read instructions</a> before clicking.', 'resmushit-image-optimizer'), 'https://resmush.it/wordpress/why-keeping-backup-files')
    415                     . '</p><p>'
    416 
    417                     . sprintf( __( 'We have found %s files ready to be removed', 'resmushit-image-optimizer' ), count(detect_unsmushed_files()) )
    418                     . '</p><p>'
    419                     . '<input type="button" value="'. __('Remove backup files', 'resmushit-image-optimizer') .'" class="rsmt-trigger--remove-backup-files button media-button  select-mode-toggle-button" name="resmushit" class="button wp-smush-send" />';
    420 
    421                 echo "</div>";
     462                . "</h3>"
     463                .   '<p>'
     464                . sprintf(__('Keep these files and turn off "Do not preserve backups" option if you want to restore your unoptimized files in the future. Please <a href="%s" title="Should I remove backups? target="_blank">read instructions</a> before clicking.', 'resmushit-image-optimizer'), 'https://resmush.it/wordpress/why-keeping-backup-files')
     465                . '</p><p>'
     466                . sprintf( __( 'We have found %s files ready to be removed', 'resmushit-image-optimizer' ), count(detect_unsmushed_files()) )
     467                . '</p><p>'
     468                . '<input type="button" value="'. __('Remove backup files', 'resmushit-image-optimizer') .'" class="rsmt-trigger--remove-backup-files button media-button  select-mode-toggle-button" name="resmushit" class="button wp-smush-send" />'
     469                . "</div>", $allowed_html);
    422470            }
    423471        }
    … …  
    483531            $attachment_resmushit_disabled = 'checked';
    484532
    485         $output = '<input type="checkbox" data-attachment-id="'. htmlspecialchars($id, ENT_QUOTES, 'UTF-8') .'"" class="rsmt-trigger--disabled-checkbox" '. $attachment_resmushit_disabled .'  />';
     533        $output = '<input type="checkbox" data-attachment-id="'. $id .'"" class="rsmt-trigger--disabled-checkbox" '. $attachment_resmushit_disabled .'  />';
    486534       
    487535        if($return)
    488536            return $output;
    489         echo $output;
     537
     538        $allowed_html = array(
     539            'input' => array(
     540                'type'      => array(),
     541                'data-attachment-id'      => array(),
     542                'checked'   => array(),
     543        ));
     544        echo wp_kses($output, $allowed_html);
    490545    }
    491546
    … …  
    506561        }
    507562        else if(reSmushit::getAttachmentQuality($attachment_id) != reSmushit::getPictureQualitySetting())
    508             $output = '<input type="button" value="'. __('Optimize', 'resmushit-image-optimizer') .'" class="rsmt-trigger--optimize-attachment button media-button  select-mode-toggle-button" name="resmushit" data-attachment-id="'. htmlspecialchars($attachment_id, ENT_QUOTES, 'UTF-8') .'" class="button wp-smush-send" />';
     563            $output = '<input type="button" value="'. __('Optimize', 'resmushit-image-optimizer') .'" class="rsmt-trigger--optimize-attachment button media-button  select-mode-toggle-button" name="resmushit" data-attachment-id="'. $attachment_id .'" class="button wp-smush-send" />';
    509564        else{
    510565            $statistics = reSmushit::getStatistics($attachment_id);
    511             $output = __('Reduced by', 'resmushit-image-optimizer') . " ". htmlspecialchars($statistics['total_saved_size_nice'], ENT_QUOTES, 'UTF-8') ." (". htmlspecialchars($statistics['percent_reduction'], ENT_QUOTES, 'UTF-8') . ' ' . __('saved', 'resmushit-image-optimizer') . ")";
    512             $output .= '<input type="button" value="'. __('Force re-optimize', 'resmushit-image-optimizer') .'" class="rsmt-trigger--optimize-attachment button media-button  select-mode-toggle-button" name="resmushit" data-attachment-id="'. htmlspecialchars($attachment_id, ENT_QUOTES, 'UTF-8') .'" class="button wp-smush-send" />';
     566            $output = __('Reduced by', 'resmushit-image-optimizer') . " ". $statistics['total_saved_size_nice'] ." (". $statistics['percent_reduction'] . ' ' . __('saved', 'resmushit-image-optimizer') . ")";
     567            $output .= '<input type="button" value="'. __('Force re-optimize', 'resmushit-image-optimizer') .'" class="rsmt-trigger--optimize-attachment button media-button  select-mode-toggle-button" name="resmushit" data-attachment-id="'. $attachment_id .'" class="button wp-smush-send" />';
    513568        }
    514569
    515570        if($return)
    516571            return $output;
    517         echo $output;
     572        $allowed_html = array_merge(wp_kses_allowed_html( 'post' ), array(
     573            'input' => array(
     574                'type'      => array(),
     575                'value'      => array(),
     576                'class'      => array(),
     577                'name'      => array(),
     578                'data-attachment-id'      => array(),
     579                'checked'   => array(),
     580        )));
     581        echo wp_kses($output, $allowed_html);
    518582    }
    519583

  • resmushit-image-optimizer/trunk/readme.txt

    r2784196 r2784230  
    44Requires at least: 4.0.0
    55Tested up to: 6.0.2
    6 Stable tag: 0.4.5
     6Stable tag: 0.4.6
    77License: GPLv2 or later
    88License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    7575== Changelog ==
    7676
     77
     78= 0.4.6 =
     79* Security fixes : protection in a WP's way
    7780
    7881= 0.4.5 =

  • resmushit-image-optimizer/trunk/resmushit.inc.php

    r2528798 r2784230  
    3131                $prefix = "[\033[32m+\033[0m]"; break;
    3232        }
    33         echo "$prefix $str\n";
     33        echo esc_html("$prefix $str\n");
    3434    }
    3535

  • resmushit-image-optimizer/trunk/resmushit.php

    r2784196 r2784230  
    1111 * Plugin URI:        https://wordpress.org/plugins/resmushit-image-optimizer/
    1212 * Description:       Image Optimization API. Provides image size optimization
    13  * Version:           0.4.5
     13 * Version:           0.4.6
    1414 * Timestamp:         2022.09.13
    1515 * Author:            reSmush.it
    … …  
    195195function resmushit_bulk_get_images() {
    196196    if(!is_super_admin() && !current_user_can('administrator')) {
    197         return(json_encode(array('error' => 'User must be at least administrator to retrieve these data')));
    198         die();
    199     }
    200     echo reSmushit::getNonOptimizedPictures();
     197        wp_send_json(json_encode(array('error' => 'User must be at least administrator to retrieve these data')));
     198        die();
     199    }
     200    wp_send_json(reSmushit::getNonOptimizedPictures());
    201201    die();
    202202}   
    … …  
    215215function resmushit_update_disabled_state() {
    216216    if(!is_super_admin() && !current_user_can('administrator')) {
    217         return(json_encode(array('error' => 'User must be at least administrator to retrieve these data')));
     217        wp_send_json(json_encode(array('error' => 'User must be at least administrator to retrieve these data')));
    218218        die();
    219219    }
    220220    if(isset($_POST['data']['id']) && $_POST['data']['id'] != null && isset($_POST['data']['disabled'])){
    221         echo htmlspecialchars(reSmushit::updateDisabledState(sanitize_text_field((int)$_POST['data']['id']), sanitize_text_field($_POST['data']['disabled'])), ENT_NOQUOTES, 'UTF-8');
     221        echo wp_kses_post(reSmushit::updateDisabledState(sanitize_text_field((int)$_POST['data']['id']), sanitize_text_field($_POST['data']['disabled'])));
    222222    }   
    223223    die();
    … …  
    238238function resmushit_optimize_single_attachment() {
    239239    if(!is_super_admin() && !current_user_can('administrator')) {
    240         return(json_encode(array('error' => 'User must be at least administrator to retrieve these data')));
     240        wp_send_json(json_encode(array('error' => 'User must be at least administrator to retrieve these data')));
    241241        die();
    242242    }
    243243    if(isset($_POST['data']['id']) && $_POST['data']['id'] != null){
    244244        reSmushit::revert(sanitize_text_field((int)$_POST['data']['id']));
    245         echo json_encode(reSmushit::getStatistics(sanitize_text_field((int)$_POST['data']['id'])));
     245        wp_send_json(json_encode(reSmushit::getStatistics(sanitize_text_field((int)$_POST['data']['id']))));
    246246    }   
    247247    die();
    … …  
    262262function resmushit_bulk_process_image() {
    263263    if(!is_super_admin() && !current_user_can('administrator')) {
    264         return(json_encode(array('error' => 'User must be at least administrator to retrieve these data')));
     264        wp_send_json(json_encode(array('error' => 'User must be at least administrator to retrieve these data')));
    265265        die();
    266266    }
    267267    rlog('Bulk optimization launched for file : ' . get_attached_file( sanitize_text_field((int)$_POST['data']['ID']) ));
    268     echo htmlspecialchars(reSmushit::revert(sanitize_text_field((int)$_POST['data']['ID'])), ENT_QUOTES, 'UTF-8');
     268    echo esc_html(reSmushit::revert(sanitize_text_field((int)$_POST['data']['ID'])));
    269269    die();
    270270}
    … …  
    284284function resmushit_update_statistics() {
    285285    if(!is_super_admin() && !current_user_can('administrator')) {
    286         return(json_encode(array('error' => 'User must be at least administrator to retrieve these data')));
     286        wp_send_json(json_encode(array('error' => 'User must be at least administrator to retrieve these data')));
    287287        die();
    288288    }
    289289    $output = reSmushit::getStatistics();
    290290    $output['total_saved_size_formatted'] = reSmushitUI::sizeFormat($output['total_saved_size']);
    291     echo json_encode($output);
     291    wp_send_json(json_encode($output));
    292292    die();
    293293}
    … …  
    454454    $return = array('success' => 0);
    455455    if(!is_super_admin() && !current_user_can('administrator')) {
    456         return(json_encode(array('error' => 'User must be at least administrator to retrieve these data')));
     456        wp_send_json(json_encode(array('error' => 'User must be at least administrator to retrieve these data')));
    457457        die();
    458458    }
    … …  
    465465        }
    466466    }
    467     echo json_encode($return);
    468467    update_option( 'resmushit_has_no_backup_files', 1);
     468    wp_send_json(json_encode($return));
    469469
    470470    die();
    … …  
    496496function resmushit_restore_backup_files() {
    497497    if(!is_super_admin() && !current_user_can('administrator')) {
    498         return(json_encode(array('error' => 'User must be at least administrator to retrieve these data')));
     498        wp_send_json(json_encode(array('error' => 'User must be at least administrator to retrieve these data')));
    499499        die();
    500500    }
    … …  
    514514        }
    515515    }
    516     echo json_encode($return);
     516    wp_send_json(json_encode($return));
    517517    die();
    518518}   

  • resmushit-image-optimizer/trunk/resmushit.settings.php

    r2784196 r2784230  
    22
    33define('RESMUSHIT_ENDPOINT', 'http://api.resmush.it/');
    4 define('RESMUSHIT_VERSION', '0.4.5');
     4define('RESMUSHIT_VERSION', '0.4.6');
    55define('RESMUSHIT_DEFAULT_QLTY', '92');
    66define('RESMUSHIT_TIMEOUT', '10');
Note: See TracChangeset for help on using the changeset viewer.